Introduction
Audience: CSP vendor owner, compliance manager
Supports: AWS, Azure, GCP
Thoropass allows for the exclusion of specific objects identified in a monitor that are causing a monitor test to fail. One way to exclude certain objects is to manually exclude them as detailed here. However, there are scenarios where resources and objects are created in your cloud infrastructure that are created often or dynamically and these may not be in scope for your compliance program.
Examples:
Proof of concepts
Development/test resources
Tag/Label Specifications
To automatically exclude a resource, the tag (or label in GCP) should follow the structure below:
Key:
thoropassignoreValue: Justification for excluding the resource. This will show up in your monitor in Thoropass just like a manual exclusion.
Instructions by Cloud Service Provider
In each CSP, you will find an example and the respective documentation for the service you want to exclude.
These examples below show you how to manually add tags for each provider. If you use any deployment service in your development pipeline or templates the thoropassignore tag can be deployed using those as well when applicable.
AWS
Documentation: AWS Tagging Resources
In AWS, you can add a tag to the resource you wish to exclude. Make sure the tag key is
thoropassignoreand the value is the justification as its value.Example:
That same instance will be excluded in the respective monitor in the Thoropass app:
Azure
Documentation: Azure Tag Resources
In Azure, follow the same procedure as in AWS.
GCP
Documentation: GCP Managing LabelsFor GCP, the process is similar but with a minor difference. GCP uses "labels" instead of "tags".